vulnerability
NotepadPlusPlus: Uncontrolled Search Path Element (CVE-2023-6401)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 4 | (AV:L/AC:L/Au:S/C:P/I:P/A:P) | Nov 30, 2023 | Dec 14, 2023 | Apr 7, 2026 |
Severity
4
CVSS
(AV:L/AC:L/Au:S/C:P/I:P/A:P)
Published
Nov 30, 2023
Added
Dec 14, 2023
Modified
Apr 7, 2026
Description
A vulnerability classified as problematic was found in NotePad++ up to 8.1. Affected by this vulnerability is an unknown functionality of the file dbghelp.exe. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The identifier VDB-246421 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Solution
notepadplusplus-upgrade-latest
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.